Evanston Township High School ransomware attack

Analyst assessment

DysruptionHub assesses with high confidence that Evanston Township High School District 202 experienced a ransomware attack beginning June 7, 2026. The district’s incident page confirms that the event disrupted district systems, internet services and computer infrastructure. Our initial report and CBS News Chicago documented the immediate campus, communications and safety effects.

The district has not identified the access vector, ransomware family, compromised accounts, encryption scope or responsible actor. Ransomware is confirmed by the victim, but the technical and attribution picture remains limited.

Operational significance

The attack disrupted network connectivity, internet, phones, staff email and Google accounts, eSchool, Home Access Center, myETHS, door access, public-address functions and other emergency or operational systems. Because systems required for safe operations were unavailable, the school closed campus June 8-9 and canceled summer school, sports camps and other activities. Campus reopened June 10, but that did not mark full technology restoration.

In a July 16 school-year preparation statement, Superintendent Marcus Campbell said core servers had been inaccessible for about a month and that teams were rebuilding critical systems and restoring services. The district expected some tools, processes and timelines to function differently, with services returning in phases and temporary workarounds continuing into the school year.

The district’s incident page documented limited system access, unavailable district phones and legacy student-information portals, device-review requirements and no specific timeline for full restoration. That page says it was last updated July 17; its continued availability does not establish that every listed limitation persists.

Current status

The district began rolling out Infinite Campus on August 12 as a replacement for myETHS and Home Access Center. The Evanston RoundTable described a gradual introduction of access and features, but it did not identify an incident-caused service outage or material operational limitation continuing on that date.

Students returned for the first day of the 2026-27 school year on August 17. Campbell told the Evanston RoundTable that opening required an extraordinary collective effort and that the district would be dealing with ripple effects for some time. The report did not identify a specific outage, degraded service or emergency workaround still occurring that day.

At its September 14 meeting, the school board recognized information technology staff for their recovery work. The Evanston RoundTable reported that staff restored internet service, reconfigured identity-management systems, implemented additional cybersecurity protections and recovered critical operational data. The report did not establish when every affected service was restored or provide a comprehensive all-clear.

The Daily Northwestern reported Oct. 14 that students continued to encounter internet reception problems on personal devices and cumbersome transcript access associated with database issues. A student technology volunteer described building-entry difficulties for freshmen who could not access digital IDs. These are specific reported recovery effects, rather than proof of another attack. The article’s suggested phishing scenario is student speculation, not an established access vector.

The district’s incoming-freshmen page, reviewed Oct. 15, explicitly ties adjusted enrollment timelines and processes to the incident and accelerated student-information-system transition. It lists enrollment opening Oct. 19; that is a scheduled milestone, not verified completion.

Reported technology difficulties continued after classes resumed. They do not establish a renewed intrusion or the exact date of complete restoration.

Extortion and data impact

CBS reported on June 8 that the district had not yet received a money demand. Later Evanston RoundTable reporting said attackers requested a ransom and that district officials had not disclosed whether it was paid. Campbell declined to comment on payment on August 17. This supports recording a ransom demand, but not a payment, refusal or negotiation outcome.

Whether personal information was accessed, copied or removed remains unresolved. The district said forensic specialists were examining that question, and no reviewed source established a confirmed data breach, leak-site listing or data publication.

Confidence and uncertainty

Confidence is high that ransomware caused material educational and safety-related disruption because the district directly confirmed the attack type and affected systems. Data availability was affected because core servers, records portals and some information workflows were inaccessible. No stable ransomware-group claim naming the district or its domain was located, so attribution remains unresolved.

Analytic gaps

The public record does not identify the access vector, ransomware family, dwell time, persistence, affected endpoints or servers, encryption scope, backup impact, ransom amount or payment status. It also does not establish whether sensitive information was acquired, the full recovery cost, the exact date every affected system was restored or whether the district will issue a final recovery notice.